In this section, the following topics are discussed to stop spamming from a server [cPanel & Exim mail service]
1) Configure Exim mail server in WebHost Manager
2) Controlling Outgoing Mail From Your Server
1) Configure Exim mail server in WebHost Manager:
Configuration page for Exim mail service can be found under "Service Configuration" in WHM. There are many sections under Exim Configuration :
a) ACL options
b) Access lists
c) Domain and IP’s
d) Filters
e) Mail
f) RBL’s [Real-Time Blocklists]
g) Security
h) SpamAssasin options
NOTE: Before editing the settings in Exim mail service, we recommend to take a backup of existing setup using “Backup” option provided in Exim Configuration Manager.
In case something goes wrong, you can easily restore this configuration settings through the backup which you have taken before.
a) ACL options: ACL stands for Access Control Options. These settings affect blacklisting, spam control, and other security-related issues. Enable the following options :
- Dictionary attack protection
- Ratelimit incoming connections with only failed recipients
- Require HELO before MAIL
- Require remote (hostname/IP address) HELO
If you want more strict rules to be followed to restrict outgoing spam mails, you can enable the following options.
- Reject SPF failures
b) Access Lists: In Access lists, you can explicitly allow certain hosts access to your SMTP server, even if they trigger your security measures. This is known as Whitelisting. (on the contrary, explicitly denying access in a similar fashion is known as Blacklisting.)
Each option in this section has an [EDIT] link which can optionally be used to whitelist or blacklist a host or IP address.
c) Domain and IP’s: The Domains and IPs settings let you control which domain names and IP addresses the server will use to send mail. Normally, we don’t recommend to tweak in this section. You can use this setting, if its fits your scenario.
d) Filters: Use the options under Filters to adjust attachment filtering and SpamAssassin filters.
Options to be Enabled :
- Attachments: Filter messages with dangerous attachments
- SpamAssassin™: Bounce mail when the spam score is greater than 20
- SpamAssassin™: Global Subject Rewrite
(click here to learn more about SpamAssassin™)
If you see too much spam getting by your filters, you can lock them down further by adjusting your internal SpamAssassin score. It is important to note that making any of these changes will affect all email accounts on the entire server.
e) Mails: Mail section contains more conditions that can be checked before an e-mail message is sent.
Options to be Enabled :
- Log sender rates in the exim mainlog
- Bounce email for users over quota
- Sender Verification
f) RBL’s: RBLs are Real-Time Blacklists contain IP addresses that have been known to send large quantities of spam. Spamcop and Spamhaus are the two RBL’s listed by default in Exim configuration. Enable one or both of these RBLs if you would prefer to block such emails at Exim.
g) Security: You should leave the Security option disabled; turning it on allows weak encryption to be used when connecting via SSL or TLS.
h) SpamAssasin Options:
- SpamAssassin: Forced Global ON [Turn on SpamAssassin for all accounts (i.e. with no option to disable).]
- Scan outgoing messages for spam and reject based on SpamAssassin internal spam_score setting
Once done, please click “Save” to save the settings done in Exim configuration.
2) Controlling Outgoing Mail from the Server:
In order to configure outgoing mails from the server, you need to go to “Tweak settings”. Follow these steps:
a) Login to WHM
b) Click on Tweak settings
c) Scroll to Mail section
Within WHM there are some settings that can limit the number of email such as
1) Number of messages sent per hour : If you wish to limit the number of messages sent per domain per hour just set the value you want in box next to “Max hourly emails per domain”. The default value is “60”
2) Prevent “nobody” from sending mail : With the help of option “Prevent “nobody” from sending mail”, you can easily prevent the user “nobody” from sending out mail to remote addresses
Note: PHP and CGI scripts generally run as “nobody” if you are using mod_php or have Suexec disabled
3) Number of failed or deferred messages a domain may send before protections can be triggered : When a domain sends this number of failed or deferred messages in an hour, and the “Maximum percentage of failed or deferred messages a domain may send per hour” has also been reached, the domain will be temporarily unable to send outgoing mail.
4) Maximum percentage of failed or deferred messages a domain may send per hour : The maximum percentage of a domain’s outgoing mail that can consist of failed or deferred messages. Once the domain exceeds this percentage, it is temporarily blocked from sending mail.
5) Track email origin via X-Source email headers : Track the origin of messages sent through the mail server by adding the X-Source headers (exim 4.34+ required). It will be useful when a Spam mail gets out and with the help of message headers, you can easily find the source of it.
6) Email delivery retry time : Time between mail server queue runs and the default value is 60 minutes. The default is a retry every hour – but you may want to extend this so the server is less strained with larger queues.
7) The percentage of email messages (above the account’s hourly maximum) to queue and retry for delivery : When an account exceeds the maximum number of emails it is allowed to send per hour, by default, any additional messages are queued for delivery and sent in the next hour. This setting allows you to limit the number of messages that will be queued by the system. For example, if you set this value to 125%, once the account reaches its hourly limit, Exim will queue any additional messages, up to 125% of the Max hourly emails per domain value. Once the account reaches 125% of the Max hourly emails per domain value, any additional outgoing messages are discarded.
